Create and manage data models in Splunk Enterprise Security
Create and manage data models using the Content Management page in Splunk Enterprise Security.
- Review the list of data models in Splunk Enterprise Security.
- Review the next scheduled time, acceleration status, and choose whether or not to accelerate a data model.
- Click a data model name to edit the data model.
Create a data model
- From the Enterprise Security menu bar, select Configure > Content > Content Management.
- Click Create New Content and select Data Model.
- Create a data model following the instructions in the Splunk platform documentation.
- For Splunk Enterprise, see Create a data model in the Splunk Enterprise Knowledge Manager Manual.
- For Splunk Cloud Platform, see Design data models in the Splunk Cloud Platform Knowledge Manager Manual.
Managing content in Splunk Enterprise Security | Create and manage key indicator searches in Splunk Enterprise Security |
This documentation applies to the following versions of Splunk® Enterprise Security: 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.3.0 Cloud only, 6.4.0, 6.4.1, 6.5.0 Cloud only, 6.5.1 Cloud only, 6.6.0, 6.6.2
Feedback submitted, thanks!